[continued from previous message]

- [armhf] dmaengine: imx-sdma: Fix a possible memory leak in
sdma_transfer_init
- ACPI: processor idle: Practically limit "Dummy wait" workaround to old
Intel systems
- Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
- net: fix NULL pointer in skb_segment_list
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.168
- firewire: fix memory leak for payload of request subaction to IEC 61883-1
FCP region
- [arm64,armhf] bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
- bpf: Fix incorrect state pruning for <8B spill/fill
- [powerpc*] imc-pmu: Revert nest_init_lock to being a mutex
- bpf: Fix a possible task gone issue with bpf_send_signal[_thread]()
helpers
- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
- bpf: Support <8-byte scalar spill and refill
- bpf: Fix to preserve reg parent/live fields when copying range info
- bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
- [arm*] drm/vc4: hdmi: make CEC adapter name unique
- scsi: Revert "scsi: core: map PQ=1, PDT=other values to
SCSI_SCAN_TARGET_PRESENT"
- vhost/net: Clear the pending messages when the backend is removed
- [armhf] WRITE is "data source", not destination...
- fix iov_iter_bvec() "direction" argument
- fix "direction" argument of iov_iter_kvec()
- virtio-net: execute xdp_do_flush() before napi_complete_done()
- sfc: correctly advertise tunneled IPv6 segmentation
- net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices
- netrom: Fix use-after-free caused by accept on already connected socket
- netfilter: br_netfilter: disable sabotage_in hook after first suppression
- squashfs: harden sanity check in squashfs_read_xattr_id_table
- [arm64] net: phy: meson-gxl: Add generic dummy stubs for MMD register
access
- igc: return an error if the mac type is unknown in
igc_ptp_systim_to_hwtstamp()
- can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate
- ata: libata: Fix sata_down_spd_limit() when no link speed is reported
- virtio-net: Keep stop() to follow mirror sequence of open()
- net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
- efi: fix potential NULL deref in efi_mem_reserve_persistent
- qede: add netpoll support for qede driver
- qede: execute xdp_do_flush() before napi_complete_done()
- scsi: target: core: Fix warning on RT kernels
- scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
(CVE-2023-2162)
- [arm64,armhf] i2c: rk3x: fix a bunch of kernel-doc warnings
- [x86] platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010
table
- [arm64] usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API
- [arm64] usb: dwc3: qcom: enable vbus override when in OTG dr-mode
- usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
- Input: i8042 - move __initconst to fix code styling warning
- Input: i8042 - merge quirk tables
- Input: i8042 - add TUXEDO devices to i8042 quirk tables
- Input: i8042 - add Clevo PCX0DX to i8042 quirk table
- fbcon: Check font dimension limits
- net: qrtr: free memory on error path in radix_tree_insert()
- [s390x] watchdog: diag288_wdt: do not use stack buffers for hardware data
- [s390x] watchdog: diag288_wdt: fix __diag288() inline assembly
- ALSA: hda/realtek: Add Acer Predator PH315-54
- efi: Accept version 2 of memory attributes table
- iio: hid: fix the retval in accel_3d_capture_sample
- iio: imu: fxos8700: fix ACCEL measurement range selection
- iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback
- iio: imu: fxos8700: fix IMU data bits returned to user space
- iio: imu: fxos8700: fix map label of channel type to MAGN sensor
- iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback
- iio: imu: fxos8700: fix incorrect ODR mode readback
- iio: imu: fxos8700: fix failed initialization ODR mode assignment
- iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN
- iio: imu: fxos8700: fix MAGN sensor scale and unit
- mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
- [x86] debug: Fix stack recursion caused by wrongly ordered DR7 accesses
- mm/swapfile: add cond_resched() in get_swap_pages()
- Squashfs: fix handling and sanity checking of xattr_ids count
- [x86] drm/i915: Fix potential bit_17 double-free
- nvmem: core: initialise nvmem->id early
- nvmem: core: fix cell removal on error
- serial: 8250_dma: Fix DMA Rx completion race
- serial: 8250_dma: Fix DMA Rx rearm race
- fbdev: smscufx: fix error handling code in ufx_usb_probe
- f2fs: fix to do sanity check on i_extra_isize in is_alive()
- wifi: brcmfmac: Check the count value of channel spec to prevent
out-of-bounds reads
- nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property
- bpf: Do not reject when the stack read size is different from the tracked
scalar size
- mm/migration: return errno when isolate_huge_page failed
- migrate: hugetlb: check for hugetlb shared PMD in node migration
- btrfs: limit device extents to the device size
- btrfs: zlib: zero-initialize zlib workspace
- ALSA: hda/realtek: Add Positivo N14KP6-TG
- ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
- ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360
- tracing: Fix poll() and select() do not work on per_cpu trace_pipe and
trace_pipe_raw
- of/address: Return an error when no valid dma-ranges are found
(Closes: #993612)
- can: j1939: do not wait 250 ms if the same addr was already claimed
- [amd64] IB/hfi1: Restore allocated resources on failed copyout
- IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
- [amd64] RDMA/usnic: use iommu_map_atomic() under spin_lock()
- xfrm: fix bug with DSCP copy to v6 from v4 tunnel
- bonding: fix error checking in bond_debug_reregister()
- [arm64] net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal
PHY
- ice: Do not use WQ_MEM_RECLAIM flag for workqueue
- [arm64] net: mscc: ocelot: fix VCAP filters not matching on MAC with
"protocol 802.1Q"
- net/mlx5e: IPoIB, Show unknown speed instead of error
- net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers
- net/mlx5: fw_tracer, Zero consumer index when reloading the tracer
- rds: rds_rm_zerocopy_callback() use list_first_entry() (CVE-2023-1078)
- ALSA: pci: lx6464es: fix a debug loop
- [armhf] pinctrl: aspeed: Fix confusing types in return value
- [arm64,armhf] pinctrl: single: fix potential NULL dereference
- [x86] pinctrl: intel: Restore the pins that used to be in Direct IRQ mode
- cifs: Fix use-after-free in rdata->read_into_pages()
- net: USB: Fix wrong-direction WARNING in plusb.c
- btrfs: free device in btrfs_close_devices for a single device filesystem
- usb: core: add quirk for Alcor Link AK9563 smartcard reader
- usb: typec: altmodes/displayport: Fix probe pin assign check
- ceph: flush cap releases when the session is flushed
- Fix page corruption caused by racy check in __free_pages
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.169
- [x86] ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers
- ALSA: hda: Do not unset preset when cleaning up codec
- net/rose: Fix to not accept on connected socket
- net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC
- net: sched: sch: Bounds check priority
- [s390x] decompressor: specify __decompress() buf len to avoid overflow
- nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association
- nvmem: core: add error handling for dev_set_name
- nvmem: core: remove nvmem_config wp_gpio
- nvmem: core: fix cleanup after dev_set_name()
- nvmem: core: fix registration vs use race
- aio: fix mremap after fork null-deref
- [s390x] signal: fix endless loop in do_signal (Closes: #1031753)
- ovl: remove privs in ovl_copyfile()
- ovl: remove privs in ovl_fallocate()
- netfilter: nft_tproxy: restrict to prerouting hook
- mmc: sdio: fix possible resource leaks in some error paths
- [arm64,armhf] mmc: mmc_spi: fix error handling in mmc_spi_probe()
- ALSA: hda/conexant: add a new hda codec SN6180
- ALSA: hda/realtek - fixed wrong gpio assigned
- sched/psi: Fix use-after-free in ep_remove_wait_queue()
- hugetlb: check for undefined shift on 32 bit architectures
- Revert "mm: Always release pages to the buddy allocator in
memblock_free_late()."
- net: Fix unwanted sign extension in netdev_stats_to_stats64()
- revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"
- ixgbe: allow to increase MTU to 3K with XDP enabled
- i40e: add double of VLAN header when computing the max MTU
- sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list
- net/sched: tcindex: update imperfect hash filters respecting rcu
(CVE-2023-1281)
- dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.
- net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
- net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()
- net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence
- bnxt_en: Fix mqprio and XDP ring checking logic
- net: stmmac: Restrict warning on disabling DMA store and fwd mode
- net: mpls: fix stale pointer if allocation fails during device rename
(CVE-2023-26545)
- ixgbe: add double of VLAN header when computing the max MTU
- ipv6: Fix datagram socket connection with DSCP.
- ipv6: Fix tcp socket connection with DSCP.
- nilfs2: fix underflow in second superblock position calculations
- [x86] drm/i915/gen11: Moving WAs to icl_gt_workarounds_init()
- [x86] drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list
- flow_offload: fill flags to action structure
- net/sched: act_ctinfo: use percpu stats
- i40e: Add checking for null for nlmsg_find_attr()
- net/sched: tcindex: search key must be 16 bits
- [x86] kvm: initialize all of the kvm_debugregs structure before sending it
to userspace (CVE-2023-1513)
- alarmtimer: Prevent starvation by small intervals and SIG_IGN
- [x86] ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak
- net: sched: sch: Fix off by one in htb_activate_prios()
- nvmem: core: fix return value
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.170
- [armhf] drm/etnaviv: don't truncate physical page address
- wifi: rtl8xxxu: gen2: Turn on the rate control
- powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G
- random: always mix cycle counter in add_latent_entropy()
- [x86] KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception
- [x86] KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid
- [x86] KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
(CVE-2022-2196)
- [x86] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
(CVE-2022-3707)
- mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
- uaccess: Add speculation barrier to copy_from_user() (CVE-2023-0459)
- Revert "Revert "block: nbd: add sanity check for first_minor""
- nbd: fix max value for 'first_minor'
- nbd: fix possible overflow for 'first_minor' in nbd_dev_add()
- nbd: fix possible overflow on 'first_minor' in nbd_dev_add()
- wifi: mwifiex: Add missing compatible string for SD8787
- audit: update the mailing list in MAINTAINERS
- ext4: Fix function prototype mismatch for ext4_feat_ktype
- Revert "net/sched: taprio: make qdisc_leaf() see the per-netdev-queue
pfifo child qdiscs"
- bpf: add missing header file include
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.171
- Fix XFRM-I support for nested ESP tunnels
- [arm64] dts: rockchip: drop unused LED mode property from rk3328-roc-cc
- [amd64,arm64] ACPI: NFIT: fix a potential deadlock during NFIT teardown
- btrfs: send: limit number of clones and allocated memory size
- [amd64] IB/hfi1: Assign npages earlier
- neigh: make sure used and confirmed times are valid
- HID: core: Fix deadloop in hid_apply_multiplier.
- bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
- net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from
sk_stream_kill_queues().
- vc_screen: don't clobber return value in vcs_read
- md: Flush workqueue md_rdev_misc_wq in md_alloc()
- drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init
(CVE-2023-22998)
- drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling
(CVE-2023-22998)
- USB: serial: option: add support for VW/Skoda "Carstick LTE"
- usb: gadget: u_serial: Add null pointer check in gserial_resume
- USB: core: Don't hold device lock while reading the "descriptors" sysfs
file
- io_uring: add missing lock in io_get_file_fixed (CVE-2023-1872)
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.172
- io_uring: ensure that io_init_req() passes in the right issue_flags
(CVE-2023-1872)
https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.173
- HID: asus: Remove check for same LED brightness on set
- HID: asus: use spinlock to protect concurrent accesses
- HID: asus: use spinlock to safely schedule workers (CVE-2023-1079)
- [powerpc*] mm: Rearrange if-else block to avoid clang warning
- [armhf] OMAP2+: Fix memory leak in realtime_counter_init()
- [arm64] dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
- [armhf] imx: Call ida_simple_remove() for ida_simple_get
- [armhf] dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
- blk-mq: avoid sleep in blk_mq_alloc_request_hctx
- blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
- blk-mq: correct stale comment of .get_budget
- [s390x] dasd: Prepare for additional path event handling
- [s390x] dasd: Fix potential memleak in dasd_eckd_init()
- sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity()
- sched/rt: pick_next_rt_entity(): check list_entry (CVE-2023-1077)
- [x86] perf/zhaoxin: Add stepping check for ZXC
- block: bio-integrity: Copy flags when bio_integrity_payload is cloned
- wifi: rsi: Fix memory leak in rsi_coex_attach()
- wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave()
- wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave()
- wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave()
- wifi: iwlegacy: common: don't call dev_kfree_skb() under
spin_lock_irqsave()
- wifi: libertas: fix memory leak in lbs_init_adapter()
- wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
- wifi: rtlwifi: Fix global-out-of-bounds bug in
_rtl8812ae_phy_set_txpower_limit()
- wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
- wifi: ipw2200: fix memory leak in ipw_wdev_init()
- wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
- wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
- wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
- wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
- wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
- wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
- wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
- wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
- [amd64] crypto: x86/ghash - fix unaligned access in ghash_setkey()
- ACPICA: Drop port I/O validation for some regions
- genirq: Fix the return type of kstat_cpu_irqs_sum()
- rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
- rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
- rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
- lib/mpi: Fix buffer overrun when SG is too long
- [amd64] crypto: ccp: Use the stack for small SEV command buffers
- [amd64] crypto: ccp: Use the stack and common buffer for status commands
- [amd64] crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent
kernel memory leak
- [amd64] crypto: ccp - Avoid page allocation failure warning for
SEV_GET_ID2
- ACPICA: nsrepair: handle cases without a return value correctly
- [arm64] thermal/drivers/tsens: Drop msm8976-specific defines
- [arm64] thermal/drivers/qcom/tsens_v1: Enable sensor 3 on MSM8976
- [arm64] thermal/drivers/tsens: Add compat string for the qcom,msm8960
- [arm64] thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
- wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
- wifi: orinoco: check return value of hermes_write_wordrec()
- wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no
callback function
- ath9k: hif_usb: simplify if-if to if-else
- ath9k: htc: clean up statistics macros
- wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
- wifi: ath9k: Fix potential stack-out-of-bounds write in
ath9k_wmi_rsp_callback()
- wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
- wifi: cfg80211: Fix extended KCK key length check in
nl80211_set_rekey_data()
- ACPI: battery: Fix missing NUL-termination with large strings
- [amd64] crypto: ccp - Failure on re-initialization due to duplicate sysfs
filename
- crypto: essiv - Handle EBUSY correctly
- crypto: seqiv - Handle EBUSY correctly
- [x86] powercap: fix possible name leak in powercap_register_zone()
- [x86] cpu: Init AP exception handling from cpu_init_secondary()
- [x86] microcode: Replace deprecated CPU-hotplug functions.
- [x86] Mark stop_this_cpu() __noreturn
- [x86] microcode: Rip out the OLD_INTERFACE
- [x86] microcode: Default-disable late loading
- [x86] microcode: Print previous version of microcode after reload
- [x86] microcode: Add a parameter to microcode_check() to store CPU
capabilities
- [x86] microcode: Check CPU capabilities after late microcode update
correctly
- [x86] microcode: Adjust late loading result reporting message
- crypto: xts - Handle EBUSY correctly
- leds: led-class: Add missing put_device() to led_put()
- [amd64] crypto: ccp - Refactor out sev_fw_alloc()
- [amd64] crypto: ccp - Flush the SEV-ES TMR memory before giving it to
firmware
- net/mlx5: Enhance debug print in page allocation failure
- irqchip: Fix refcount leak in platform_irqchip_probe
- irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
- irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
- irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
- [s390x] vmem: fix empty page tables cleanup under KASAN
- net: add sock_init_data_uid()
- tun: tun_chr_open(): correctly initialize socket uid (CVE-2023-1076)
- tap: tap_open(): correctly initialize socket uid (CVE-2023-1076)
- OPP: fix error checking in opp_migrate_dentry()
- Bluetooth: L2CAP: Fix potential user-after-free
- rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
- crypto: rsa-pkcs1pad - Use akcipher_request_complete
- wifi: iwl3945: Add missing check for create_singlethread_workqueue
- wifi: iwl4965: Add missing check for create_singlethread_workqueue()
- wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
- wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
- [arm64] thermal/drivers/hisi: Drop second sensor hi3660
- can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a
bus error
- bpf: Fix global subprog context argument resolution logic
- l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
- [arm64] net: bcmgenet: fix MoCA LED control
- drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
- drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
- [arm*] drm/vc4: dpi: Add option for inverting pixel clock and output
enable
- [arm*] drm/vc4: dpi: Fix format mapping for RGB565
- [armhf] gpu: ipu-v3: common: Add of_node_put() for reference returned by
of_graph_get_port_by_id()
- [arm64] drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
- [armhf] pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
- [arm64,armhf] pinctrl: rockchip: add support for rk3568
- [arm64,armhf] pinctrl: rockchip: do coding style for mux route struct
- [arm64,armhf] pinctrl: rockchip: Fix refcount leak in
rockchip_pinctrl_parse_groups
- [arm*] drm/vc4: hvs: Set AXI panic modes
- [arm*] drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
- [arm*] drm/vc4: hdmi: Correct interlaced timings again
- [arm64] ASoC: fsl_sai: initialize is_dsp_mode flag
- [arm64] drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
- ALSA: hda/ca0132: minor fix for allocation size
- [arm64] drm/msm/dpu: Disallow unallocated resources to be returned
- drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
- [arm64] drm/msm: use strscpy instead of strncpy
- [arm64] drm/msm/dpu: Add check for cstate
- [arm64] drm/msm/dpu: Add check for pstates
- [arm64] drm/msm/mdp5: Add check for kzalloc
- [arm*] pinctrl: bcm2835: Remove of_node_put() in
bcm2835_of_gpio_ranges_fallback()
- [x86] ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
- drm/amdgpu: fix enum odm_combine_mode mismatch
- scsi: mpt3sas: Fix a memory leak
- scsi: aic94xx: Add missing check for dma_map_single()
- dm: remove flush_scheduled_work() during local_exit()
- NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode()
- NFSv4: keep state manager thread active if swap is enabled
- nfs4trace: fix state manager flag printing
- NFS: fix disabling of swap
- HID: bigben: use spinlock to protect concurrent accesses
- HID: bigben_worker() remove unneeded check on report_field
- HID: bigben: use spinlock to safely schedule workers (CVE-2023-25012)
- hid: bigben_probe(): validate report count
- nfsd: fix race to check ls_layouts
- cifs: Fix lost destroy smbd connection when MR allocate failed
- cifs: Fix warning and UAF when destroy the MR list
- gfs2: jdata writepage fix
- leds: led-core: Fix refcount leak in of_led_get()
- [armhf] mtd: rawnand: sunxi: Fix the size of the last OOB region
- [arm64,armhf] clk: imx: avoid memory leak
- Input: ads7846 - don't report pressure for ads7845
- Input: ads7846 - convert to full duplex
- Input: ads7846 - convert to one message
- Input: ads7846 - always set last command to PWRDOWN
- Input: ads7846 - don't check penirq immediately for 7845
- [powerpc*] powernv/ioda: Skip unallocated resources when mapping to PE
- clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
- [powerpc*] perf/hv-24x7: add missing RTAS retry status handling
- [powerpc*] pseries/lpar: add missing RTAS retry status handling
- [powerpc*] pseries/lparcfg: add missing RTAS retry status handling
- [powerpc*] rtas: make all exports GPL
- [powerpc*] rtas: ensure 4KB alignment for rtas_data_buf
- [powerpc*] eeh: Small refactor of eeh_handle_normal_event()
- [powerpc*] eeh: Set channel state after notifying the drivers
- [armhf] media: platform: ti: Add missing check for devm_regulator_get
- media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
(CVE-2023-1118)
- media: usb: siano: Fix use after free bugs caused by do_submit_urb
- media: saa7134: Use video_unregister_device for radio_dev
- [arm64] rpmsg: glink: Avoid infinite loop on intent for missing channel
- udf: Define EFSCORRUPTED error code
- blk-iocost: fix divide by 0 error in calc_lcoefs()
- wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
- wifi: brcmfmac: Fix potential stack-out-of-bounds in
brcmf_c_preinit_dcmds()
- rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
- rcu: Suppress smp_processor_id() complaint in
synchronize_rcu_expedited_wait()
- rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
- wifi: ath11k: debugfs: fix to work with multiple PCI devices
- [x86] thermal: intel: Fix unsigned comparison with less than zero
- timers: Prevent union confusion from unexpected restart_syscall()
- [x86] bugs: Reset speculation control settings on init
- wifi: brcmfmac: ensure CLM version is null-terminated to prevent
stack-out-of-bounds
- wifi: mt7601u: fix an integer underflow
- inet: fix fast path in __inet_hash_connect()
- ice: add missing checks for PF vsi type
- ACPI: Don't build ACPICA with '-Os'
- clocksource: Suspend the watchdog temporarily when high read latency
detected
- net: bcmgenet: Add a check for oversized packets
- wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
- ACPI: video: Fix Lenovo Ideapad Z570 DMI match
- net/mlx5: fw_tracer: Fix debug print
- coda: Avoid partial allocation of sig_inputArgs
- uaccess: Add minimum bounds check on kernel buffer size
- PM: EM: fix memory leak with using debugfs_lookup()
- Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
- drm/amd/display: Fix potential null-deref in dm_resume
- [armhf] drm/omap: dsi: Fix excessive stack usage
- HID: Add Mapping for System Microphone Mute
- drm/radeon: free iio for atombios when driver shutdown
- drm: amd: display: Fix memory leakage
- [arm64] drm/msm/dsi: Add missing check for alloc_ordered_workqueue
- [armel,armhf] ASoC: kirkwood: Iterate over array indexes instead of using
pointer math
- [armhf] regulator: s5m8767: Bounds check id indexing into arrays
- gfs2: Improve gfs2_make_fs_rw error handling
- [x86] hwmon: (coretemp) Simplify platform device handling
- HID: logitech-hidpp: Don't restart communication if not necessary
- drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
- dm thin: add cond_resched() to various workqueue loops
- dm cache: add cond_resched() to various workqueue loops
- nfsd: zero out pointers after putting nfsd_files on COPY setup error
- wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
- firmware: coreboot: framebuffer: Ignore reserved pixel color bits
- [arm64] rtc: pm8xxx: fix set-alarm race
- ipmi_ssif: Rename idle state and check
- [s390x] extmem: return correct segment type in __segment_load()
- [s390x] discard .interp section
- [s390x] kprobes: fix irq mask clobbering on kprobe reenter from
post_handler
- [s390x] kprobes: fix current_kprobe never cleared after kprobes reenter
- cifs: Fix uninitialized memory read in smb3_qfs_tcon()
- hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
- fs: hfsplus: fix UAF issue in hfsplus_put_super
- exfat: fix reporting fs error when reading dir beyond EOF
- exfat: fix unexpected EOF while reading dir
- exfat: redefine DIR_DELETED as the bad cluster number
- exfat: fix inode->i_blocks for non-512 byte sector size device
- f2fs: fix information leak in f2fs_move_inline_dirents()
- f2fs: fix cgroup writeback accounting with fs-layer encryption
- ocfs2: fix defrag path triggering jbd2 ASSERT
- ocfs2: fix non-auto defrag path not working issue
- udf: Truncate added extents on failed expansion
- udf: Do not bother merging very long extents
- udf: Do not update file length for failed writes to inline files
- udf: Preserve link count of system files
- udf: Detect system inodes linked into directory hierarchy
- udf: Fix file corruption when appending just after end of preallocated
extent
- KVM: Destroy target device if coalesced MMIO unregistration fails
- [x86] KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
- [s390x] KVM: s390: disable migration mode when dirty tracking is disabled
- [x86] virt: Force GIF=1 prior to disabling SVM (for reboot flows)
- [x86] crash: Disable virt in core NMI crash handler to avoid double
shootdown
- [x86] reboot: Disable virtualization in an emergency if SVM is supported
- [x86] reboot: Disable SVM, not just VMX, when stopping CPUs
- [x86] kprobes: Fix __recover_optprobed_insn check optimizing logic
- [x86] kprobes: Fix arch_check_optimized_kprobe check within
optimized_kprobe range
- [x86] microcode/amd: Remove load_microcode_amd()'s bsp parameter
- [x86] microcode/AMD: Add a @cpu parameter to the reloading functions
- [x86] microcode/AMD: Fix mixed steppings support
- [x86] speculation: Allow enabling STIBP with legacy IBRS (CVE-2023-1998)
- Documentation/hw-vuln: Document the interaction between IBRS and STIBP
- brd: return 0/-error from brd_insert_page()
- ima: Align ima_file_mmap() parameters with mmap_file LSM hook
- irqdomain: Fix association race
- irqdomain: Fix disassociation race
- irqdomain: Drop bogus fwspec-mapping error handling
- io_uring: handle TIF_NOTIFY_RESUME when checking for task_work
- io_uring: mark task TASK_RUNNING before handling resume/task work
- io_uring: add a conditional reschedule to the IOPOLL cancelation loop
- io_uring/rsrc: disallow multi-source reg buffers
- io_uring: remove MSG_NOSIGNAL from recvmsg
- io_uring/poll: allow some retries for poll triggering spuriously
- ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
- ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
- jbd2: fix data missing when reusing bh which is ready to be checkpointed
- ext4: optimize ea_inode block expansion
- ext4: refuse to create ea block when umounted
- mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
- dm: add cond_resched() to dm_wq_work()
- wifi: rtl8xxxu: Use a longer retry limit of 48
- wifi: cfg80211: Fix use after free for wext
- [x86] thermal: intel: powerclamp: Fix cur_state for multi package system
- dm flakey: fix logic when corrupting a bio
- dm flakey: don't corrupt the zero page
- rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
- dax/kmem: Fix leak of memory-hotplug resources
- mm: memcontrol: deprecate charge moving
- mm/thp: check and bail out if page in deferred queue already
- ring-buffer: Handle race between rb_move_tail and rb_check_pages
- scsi: qla2xxx: Fix link failure in NPIV environment

[continued in next message]

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)